Privacy Policy

We are a small, family-run business renting five holiday apartments in Vlorë. We ask for as little information as we can, we use it to answer you and arrange your stay, and we never sell it. This page explains what we collect through our website, why we are allowed to, who else sees it, and what you can ask us to do about it.

Who is responsible

Apartments Vlora Holidays
Rruga Murat Tërbaçi, Vlorë, Albania
apartmentsvloraholidays@gmail.com
vloraholidays.com

We are the people who decide what happens to the information described here. Write to the address above and you will reach us directly.

What we collect

When you send an inquiry. Only what you type into the form on our contact page:

• Your name
• Your email address
• Your phone number, if you choose to give it — this field is optional
• Your arrival and departure dates, the number of guests, and which apartment you are asking about
• Anything you write in the message box

Using the form is voluntary, and nothing on this website obliges you to send us anything. Without at least a name, an email address and your dates we cannot reply or hold an apartment for you; your phone number is optional and we manage perfectly well without it. If you go on to book, we may need further details at that stage to complete the booking and to meet the requirements that apply to accommodation providers — we will tell you what is needed and why at the time.

We do not ask for payment card details anywhere on this website, and you should never send them to us by email or message.

When you simply read the site. Our analytics counts page visits, and our web hosting keeps the ordinary records any web server keeps in order to serve pages and guard against abuse.

Why we use it, and what allows us to

Different activities rest on different legal bases.

Answering your inquiry and arranging your stay. Our basis is the steps taken at your own request before entering into a contract, and the performance of that contract if you go on to book with us. In plain terms: you asked us about a stay, so we use what you sent to answer you.

Counting page visits, and keeping the site working and secure. Our basis is our legitimate interest in knowing which pages are read and in keeping the website available and protected from abuse. Nobody asks us to do this, so it cannot rest on the basis above. You may object to it — see Your rights.

We do not rely on your consent for either of these, so there is no consent for you to withdraw. If we ever introduce something that does rely on consent, we will ask you plainly and you will be free to withdraw it at any time, as easily as you gave it.

We do not send marketing emails, we do not add you to any mailing list, and we do not sell or share your details with anyone for their own purposes. We make no automated decisions about you and we do no profiling.

Who else receives your information

Web3Forms delivers the contact form. When you press Send Inquiry, your message goes to Web3Forms, which forwards it to our email inbox. Their documentation describes their role as receiving, validating, storing and forwarding submissions, so a copy exists on their systems as well as in our inbox. It also names the other companies they rely on, including spam-filtering and analytics services that see the sender’s IP address and email address. Their documentation is published at web3forms.com/privacy and web3forms.com/dpa.

If you would rather your message did not pass through them, you can email us, message us on WhatsApp, or telephone instead. Those routes avoid the form, but no route is free of intermediaries: email travels through email services at both ends, WhatsApp carries and processes messages under its own arrangements, and telephone calls pass through telecommunications networks and may be logged by them.

Cloudflare Web Analytics counts page visits so we can see which pages people read. Cloudflare’s own documentation describes it as privacy-first analytics and states that it does not collect or use visitors’ personal data, and that its script stores nothing in your browser. That is Cloudflare’s description of their product rather than something we have independently tested. See the Cloudflare privacy policy and their Web Analytics documentation.

Google Maps can show the location on each apartment page. The map is an embedded Google frame set to load only when you scroll far enough down the page to reach it, so if you never scroll that far it is never loaded. This limits when Google is contacted; it does not make the map private. Once the map loads, your browser contacts Google directly, which means Google receives your IP address and the usual request information and may set its own cookies in your browser, under the Google privacy policy rather than this one.

WhatsApp. Several pages link to WhatsApp. Following one of those links opens WhatsApp and nothing is sent until you press send yourself. Any conversation that follows is carried and processed by WhatsApp under their own privacy policy, alongside our own copy of the messages.

Our web hosting stores the website and serves its pages.

Cookies and browser storage

We tested our own domain and found that it sets no cookies and writes nothing to your browser’s storage. We run no advertising or tracking cookies of our own. That is why you are not asked to dismiss a cookie banner here.

This finding covers our own domain only. The embedded Google map is a third-party frame, and once it loads, what it places in your browser is governed by Google’s terms rather than ours.

How long we keep it

Inquiry emails stay in our inbox for up to 24 months, so that we can look back at a previous booking or conversation, and are deleted after that. If you ask us to delete yours sooner, we will.

That is our period and it is not our providers’. Web3Forms’ privacy policy states that form submissions are kept for a maximum of three years from the date of submission and are then deleted automatically, that a shorter period may apply depending on the plan, and that submissions can be deleted earlier from the account they belong to. Deleting an email from our inbox does not by itself remove their copy. If you ask us to erase your information, we will delete what we hold and also remove the submission from the form service, so far as our account allows.

International transfers

We are based in Albania, which does not currently appear on the European Commission’s list of countries recognised as providing an adequate level of data protection. Some of the providers named above process information in more than one country, including outside the European Economic Area, so depending on the service involved your information may be processed internationally.

Web3Forms’ data processing agreement states that transfers out of the EEA, the United Kingdom and Switzerland rely on the European Commission’s Standard Contractual Clauses, with the UK Addendum where it applies. For Cloudflare, Google and WhatsApp, the arrangements that apply are set out in their own terms, which are linked above and which we would encourage you to read if this matters to you.

If you would prefer your details were not handled this way, contact us by telephone rather than using the website form.

Security

We keep inquiries in an ordinary business email account, and we disclose them only as described in this policy or where required or permitted by law. We are a small family business, not a large company with a security department, and we think it is more honest to say so than to list protections we have not had independently checked. Please do not send us passwords, payment card numbers or copies of identity documents.

Your rights

Depending on your circumstances and the law that applies to you, you can ask us to:

• give you a copy of the information we hold about you
• correct anything that is wrong or incomplete
• delete it
• pause our use of it while something is being checked or disputed
• stop using it altogether, where you object to our doing so
• send it to you, or to someone else, in a portable format
• withdraw your consent, where we have relied on consent for something

Not every right applies in every situation — some depend on the legal basis we are relying on, and some have exceptions in law. If we cannot do what you ask, we will tell you why.

Email apartmentsvloraholidays@gmail.com and we will reply as quickly as we can, and in any event within the time limits that apply to us. Asking costs nothing.

You can also complain to a supervisory authority. In Albania this is the Commissioner for the Right to Information and Protection of Personal Data. In the European Union or the United Kingdom it is the data protection authority for your country.

Children

Our website is aimed at adults booking a holiday. We do not knowingly collect information about children through it. If a booking involves children, we only know what the person making the booking chooses to tell us.

Changes to this policy

If we change how any of this works, we will update this page and change the date at the top. If anything here looks wrong or out of date, please tell us at apartmentsvloraholidays@gmail.com and we will put it right.